The Sarbox Hot Potato

While acknowledging, and even joining in, mounting criticism of the Sarbanes-Oxley Act, lawmakers remain reluctant to make any changes to the law. Rather, they want the Securities and Exchange Commission to make improvements.

Both Congress and the Securities and Exchange Commission have been under intense pressure this week as two separate roundtables held by the U.S. Treasury Department and the Chamber of Commerce examined whether business regulations have had an adverse effect on U.S. capital markets. The crux of both the roundtables and a series of related reports is that Sarbox — which passed the Senate unanimously and received only three 'no' votes in the House— has been too expensive and burdensome for companies of all sizes.

For its part, the SEC has acknowledged that the internal-control provision of Sarbox — section 404 — has been troublesome and recently proposed changes that could help companies in complying with the law. The law itself is not the problem, said SEC Chairman Christopher Cox during the U.S. Chamber hearing on Wednesday. "We don't need to change the law," he said. "We need to change the way the law is implemented." (Cox's words echo, verbatim, a comment made by President Bush in his January 31 speech to Wall Street.)

Barney Frank, the chairman of the House Financial Services Committee, said at the Chamber meeting that he would rather not make changes to the law but is open to the idea. The problem with Sarbox may have been its lack of guidance from lawmakers, he implied. "We relied too heavily on accountants on how they interpreted 404," he said.

The SEC and the Public Company Accounting Oversight Board tried to simplify the auditing process under Sarbox and clarify how the work should be done when they introduced proposed changes to Section 404 and Auditing Standard No. 2, respectively, last December. Both regulators called for management and auditors to take a "risk-based, top-down approach" meaning external auditors need to focus on only those areas that are critical to a financial statements' accuracy. The public comments for those revisions ended February 26.

But those revisions don't go far enough to address businesses' chief complaints, according to Rep. Gregory Meeks (D-New York), who introduced a bill to make changes to Section 404 on Tuesday. The legislation would exempt small businesses from the provision and give the SEC a list of to-do items, including: define materiality and fix the lopsided competition among the audit firms.

But the bill itself should be an agenda item for the SEC, Meeks told CFO.com, as he and the two co-sponsors of the bill hope it will spark debate between lawmakers and the regulator and spur the SEC to make changes on its own accord. "We hope the SEC will get that the message and change the regulation so we don't have to do it legislatively," he said.

Sarbox and the proposed revisions by the SEC and PCAOB should be made clearer so that businesses and auditors "don't have to guess how to interpret the law," Meeks said. He added that the SEC has the authority to make the changes outlined in his bill.

Like the PCAOB, Meeks' bill calls for audits of internal controls to be top-down and risk-based. In other ways, however, the legislation calls for changes the SEC and PCAOB have not addressed. The congressmen want companies to be audited in their first year of compliance, and then only every three years, unless something major has happened, such as a merger, "significant" restatement, or another event that the SEC would determine would apply. The bill also calls for the SEC to develop a standard for materiality "based on whether the internal control has a material effect on the company's financial statements."

The congressmen also put the responsibility on the SEC's and PCAOB's shoulders to fix the conflict-of-interest provisions that are hard for large companies to navigate when they want to use only the Big Four audit firms. To fix that, the lawmakers say, the PCAOB should recommend ways that the large firms can partner with smaller firms.

The majority of comment letters to the SEC and PCAOB on their recent revisions praised the regulators for moving in the right direction but they suggest additional changes. Senior finance executives predicted that auditors will ignore the regulators' push to have them focus on the highest-risk areas and continue to take the overly conservative approach that has been widely blamed on the existing auditing standard.